Cryptography Case Studies

Cryptography uses different tools for different jobs: establishing a shared secret, authenticating a person or device, and protecting a message. Quantum key distribution uses measured quantum systems to help establish a key. Post-quantum cryptography uses classical computations designed to resist quantum attacks. Neither name describes a complete secure communication system by itself.

The case studies below connect these distinctions to optical loss, completed key-generation experiments and estimates of large quantum computations. The numerical examples are teaching models; the cited experiments have their own device parameters and security analyses.

Required background. Quantum key distribution and BB84 explain key agreement, authentication and complementary bases. Helpful background. Decoy states explain photon-number estimation; entanglement-based QKD, measurement-device-independent QKD and device-independent QKD distinguish device assumptions. Shor’s algorithm supplies the factoring mechanism.

Weak optical pulses in a lossy fiber

A fiber of length $L$ and attenuation $\alpha$ in dB per unit length has transmission

$$\eta_{\mathrm{ch}}=10^{-\alpha L/10}.$$

At $\alpha=0.2\,\mathrm{dB/km}$, 200 km gives 40 dB loss and transmission $10^{-4}$. This excludes connector, optical and detector losses. If the additional optical transmission is 0.8 and detector efficiency is 0.25, the probability that an individual emitted photon is detected is $\eta=2\times10^{-5}$.

A phase-randomized coherent pulse with mean photon number $\mu$ has Poisson probabilities

$$P_\mu(n)=e^{-\mu}\frac{\mu^n}{n!}.$$

For $\mu=0.5$, about 60.65% of pulses are vacuum, 30.33% contain one photon, and 9.02% contain at least two. Making the pulse weak therefore does not make it a single-photon source. Multiphoton emissions require special treatment in the security analysis.

Independent attenuation gives a signal-click probability $p_s=1-e^{-\mu\eta}$. Let $Y_0=10^{-6}$ be a background-click probability per pulse and $e_d=0.015$ the error fraction for signal detections. Neglecting the rare overlap of signal and background events gives

$$\begin{aligned} Q_\mu&\simeq p_s+Y_0,\\ E_\mu&\simeq\frac{e_dp_s+Y_0/2}{p_s+Y_0}. \end{aligned}$$

Here $Q_\mu$ is a click probability and $E_\mu$ is a raw bit-error fraction; background bits are assumed random. At 200 km, $p_s\simeq10^{-5}$, $Q_\mu\simeq1.1\times10^{-5}$ and $E_\mu\simeq5.91\%$. At still greater loss, background dominates and the error fraction approaches one half.

Illustrative weak-pulse model with $\mu=0.5$, fiber attenuation $0.2\,\mathrm{dB/km}$, optical transmission 0.8, detector efficiency 0.25, background probability $10^{-6}$ and signal error fraction 1.5%. The signal and background contributions become equal near 250 km. These curves describe raw detections, not a secret-key rate or a universal distance limit.

Decoy states reveal which detections can contribute to a key

Different pulse intensities change the photon-number probabilities. In the ideal decoy model, they do not change the conditional state at fixed photon number:

$$\rho_\mu=\sum_n P_\mu(n)\rho_n.$$

The same $\rho_n$ must describe the relevant emitted degrees of freedom for signal and decoy choices, with the bit and basis held fixed. Then their conditional yields $Y_n$ can be shared in the inference $Q_\mu=\sum_nP_\mu(n)Y_n$. Comparing several intensities bounds the single-photon contribution. Ma and collaborators (2005) develop practical versions of this method.

Keeping the intensity label secret until later is insufficient if pulse timing, spectrum or another accessible degree of freedom reveals it. Two orthogonal labels attached to otherwise identical one-photon states could be distinguished immediately. Tamaki, Curty and Lucamarini (2016) analyze source leakage explicitly; a proof that includes such leakage can replace the ideal common-state assumption. Leakage cannot simply be ignored.

An asymptotic BB84 expression illustrates the remaining information needed. Let $p_{\mathrm{sig}}$ be the fraction of emitted pulses using the signal intensity and $q$ the probability that a signal round uses the matching key-generation basis. A standard achievable-rate bound has the form

$$\begin{aligned} R&\ge p_{\mathrm{sig}}q\,[\,r_1-r_{\mathrm{EC}}\,],\\ r_1&=Q_1[1-h_2(e_1^{\mathrm{ph}})],\\ r_{\mathrm{EC}}&=Q_\mu f_{\mathrm{EC}}h_2(E_\mu). \end{aligned}$$

The rate is in secret bits per emitted pulse. The yields and bit errors here refer to signal rounds in the key basis. Here $Q_1=P_\mu(1)Y_1$, $h_2$ is binary entropy, $f_{\mathrm{EC}}\ge1$ describes error-correction inefficiency, and $e_1^{\mathrm{ph}}$ is the single-photon phase-error rate bounded by complementary-basis data. It is not automatically the observed key-basis bit-error rate. A negative bound certifies no positive rate by this expression. Finite blocks additionally need statistical bounds and finite-key corrections; the asymptotic formula does not establish a finite experimental key.

Boaron and collaborators (2018) demonstrated finite-key QKD over 421 km of optical fiber using a three-state, time-bin, one-decoy protocol. Their reported 6.5 bits/s rate was at 405 km, not at the maximum distance. Low detector noise, suitable optical components and the full finite-key analysis were all part of the result. The simple model above explains why background matters, but does not reproduce that experiment’s performance.

Distance, entanglement and device assumptions

For a single pure-loss bosonic channel of transmission $\eta$, Pirandola and collaborators (2017) obtained the unconstrained-energy, asymptotic secret-key capacity with unlimited two-way classical assistance:

$$\begin{aligned} K(\eta)&=-\log_2(1-\eta)\\ &\simeq1.4427\eta\quad(\eta\ll1). \end{aligned}$$

An implementation rate per channel mode cannot exceed this capacity under those channel assumptions. It is not a bound in bits per second until a mode rate is supplied. Different network architectures, energy constraints, thermal noise or finite blocks require their appropriate models.

Putting an entangled-pair source halfway between receivers does not alone change the exponential loss law: both photons must arrive, so the transmission factor is $\eta_A\eta_B$. For equal attenuation along a total distance $L$, this product is the same $10^{-\alpha L/10}$. Repeaters and other heralded protocols use additional resources and different success mechanisms; see network case studies.

Yin and collaborators (2020) distributed satellite-generated entangled photons to ground stations separated by 1,120 km and reported a finite secret-key rate of 0.12 bits/s. The protocol avoided a trusted key relay at the satellite, but relied on characterized receiving devices. Entanglement-based security is therefore not synonymous with device-independent security.

Nadlinger and collaborators (2022) generated a 95,628-bit key from approximately 1.5 million entangled ion pairs collected over eight hours. Their finite-key analysis used Bell correlations to bound secrecy without a detailed internal measurement-device model. The demonstration did not use spacelike separation of the measurement events. Device-independent security still requires the assumed isolation between systems, suitable random settings, protected laboratories and authenticated classical communication. A Bell violation alone, without the protocol’s other conditions and finite-key analysis, is not a completed key.

Post-quantum key establishment and signatures do different jobs

NIST published three relevant standards in 2024. They are classical algorithms: their intended security includes resistance to quantum attackers under computational assumptions.

Primitive	Standard	Role
ML-KEM	FIPS 203	Establish a shared secret from an encapsulation key and ciphertext
ML-DSA	FIPS 204	Sign messages and verify signatures
SLH-DSA	FIPS 205	Sign messages using a stateless hash-based construction

A KEM does not by itself establish whose public key was used. A signature can authenticate a message when the verification key is already associated securely with the claimed sender. Neither alone encrypts an application data stream. NIST SP 800-227 (2025) explains KEM use within larger constructions; the standards’ publication pages also provide implementation updates and errata.

For example, a device receiving a signed firmware update needs to verify the publisher and the intended version, even when it is offline. A private network session instead needs a shared traffic key and authentication of the communicating parties. QKD may supply key material for a suitable optical link, but does not replace the publicly verifiable signature on the firmware.

Combining conventional and post-quantum components also requires a defined, analyzed protocol. If an attacker changes a KEM ciphertext and the parties derive different keys, a valid key-confirmation check may simply reject the session. That is a disruption, not automatically an accepted security failure. Conversely, a negotiation that permits unauthenticated removal of the post-quantum option can leave both parties agreeing on an unintended weaker suite. The authenticated transcript must bind the choices that matter to the protocol.

Factoring estimates are conditional resource calculations

Shor’s algorithm threatens RSA and discrete-logarithm systems by exploiting algebraic structure. Grover search provides a different, quadratic query improvement for unstructured key search; it does not give the same polynomial-time attack on symmetric cryptography. Actual runtimes depend on implementing the necessary oracle or arithmetic.

Gidney and Ekerå (2021) estimated RSA-2048 factoring in about eight hours with 20 million physical qubits. Gidney’s 2025 preprint estimated fewer than one million physical qubits with a runtime below one week. Both assume nearest-neighbor planar connectivity, physical gate errors near $10^{-3}$, one-microsecond surface-code cycles and ten-microsecond control reaction time. The newer estimate changes arithmetic, storage and magic-state production, trading a lower qubit count for a longer computation. These are estimates for specified architectures and algorithms, not reported factoring experiments or forecasts of machine availability.

Long-lived confidentiality makes the timing question broader than the date of an attack. If recorded data must remain secret for ten years, replacing a vulnerable key-establishment system eight years from now does not protect recordings made before replacement. A later change cannot retroactively strengthen an old ciphertext. This observation motivates planning for data lifetimes without predicting when a cryptographically relevant quantum computer will be built.

Exercises

1. Counting emitted photons

For $\mu=0.5$, calculate the vacuum, one-photon and multiphoton probabilities. Does a low detected error rate by itself show that detections came from one-photon emissions?

Solution

$$\begin{aligned} P_0&=e^{-0.5}\approx0.60653,\\ P_1&=0.5e^{-0.5}\approx0.30327,\\ P_{\ge2}&=1-P_0-P_1\approx0.09020. \end{aligned}$$

No. Loss can affect the photon-number sectors differently, and some multiphoton attacks need not create a large bit-error rate. Decoy observations constrain these conditional yields.

2. Why background changes the error fraction

Use the page’s 200 km parameters to calculate $p_s$, $Q_\mu$ and $E_\mu$. What is the limiting error fraction when the signal vanishes?

Solution

The mean detected signal photon number is $\mu\eta=10^{-5}$, so

$$\begin{aligned} p_s&=1-e^{-10^{-5}}\simeq10^{-5},\\ Q_\mu&\simeq1.1\times10^{-5},\\ E_\mu&\simeq\frac{0.015(10^{-5})+0.5(10^{-6})} {1.1\times10^{-5}}\\ &\simeq0.0591. \end{aligned}$$

For $p_s\to0$, only random background bits remain and $E_\mu\to1/2$. No secret-key rate has yet been calculated.

3. A distinguishable decoy

At fixed photon number, signal pulses carry an extra state $|s\rangle$ and decoy pulses carry an orthogonal state $|d\rangle$. Does delaying the announcement of intensity restore the ideal common-yield argument?

Solution

No. Measuring the orthogonal tag distinguishes the two cases before any announcement, so an adversary can treat them differently. The ideal relation with one common $Y_n$ is not justified. The experiment must eliminate the distinguishability or use a security analysis that bounds and includes it.

4. Key-rate denominators

A finite analysis produces 95,628 secret bits from 1.5 million recorded pairs in eight hours. Find bits per recorded pair and average bits per second. Is either number bits per attempted pair generation?

Solution

$$\begin{aligned} 95{,}628/(1.5\times10^6)&=0.063752,\\ 95{,}628/(8\times3600)&\simeq3.32\ \mathrm{bits/s}. \end{aligned}$$

Neither gives bits per attempt without the attempt count. Heralding losses and failed generation attempts change that denominator. The time average includes the collection interval specified in the example.

5. Two arms do not remove loss

A source is at the midpoint of a 200 km fiber route with attenuation $0.2\,\mathrm{dB/km}$. Ignoring all other losses, what fraction of emitted pairs has both photons transmitted?

Solution

Each 100 km arm transmits $10^{-2}$. Independent survival of both photons gives $(10^{-2})^2=10^{-4}$ per emitted pair. The individual arm transmission is the square root of the end-to-end transmission, but the coincidence requires their product.

6. Capacity and time

Evaluate the pure-loss capacity at $\eta=10^{-4}$. What upper bound in bits/s follows for $10^8$ uses/s of that single-mode channel?

Solution

$$\begin{aligned} K&=-\log_2(0.9999)\\ &\simeq1.44277\times10^{-4}\ \mathrm{bits/use}. \end{aligned}$$

Multiplication gives about $1.44\times10^4$ bits/s. This is an asymptotic capacity bound under the stated assumptions, not an achievable rate for the toy detector model or for a particular finite experiment.

7. Key expansion and authentication cost

A successful QKD block outputs 20,000 secret bits and irreversibly consumes 256 previously shared secret bits for authentication. If all other deductions are already included in the output, what is the net key expansion?

Solution

The net gain is $20{,}000-256=19{,}744$ bits. The premise specifies consumed bits; schemes that safely recycle part of an authentication key need their own accounting. This arithmetic is not a proof of authentication or secrecy.

8. Rejection versus accepted compromise

An altered KEM ciphertext makes two parties derive different traffic keys. They check a secure key-confirmation tag under the derived key before accepting. What conclusion follows from rejection? What separate issue arises if negotiated algorithm choices are never authenticated?

Solution

Rejection shows a failed session, consistent with a denial-of-service attempt. It does not demonstrate that either side accepted an attacker-known session key. Unauthenticated choices can instead permit a downgrade in which both parties agree on a weaker allowed suite. Whether that succeeds depends on the protocol and local policy; the ciphertext-change example alone does not establish it.

9. Which primitive fits the task?

Would an ML-KEM ciphertext alone authenticate a firmware update? Would a valid signature alone make a transmitted document confidential?

Solution

No to both. Firmware authentication needs a verifiable signature under the trusted publisher’s verification key, together with the relevant version checks. A signature does not conceal the document; confidentiality requires an encryption construction and appropriate key management. The primitives solve different parts of a communication problem.

References

• Boaron, A., et al. “Secure quantum key distribution over 421 km of optical fiber.” Physical Review Letters 121, 190502 (2018). doi:10.1103/PhysRevLett.121.190502.
• Gidney, C. “How to factor 2048 bit RSA integers with less than a million noisy qubits.” arXiv:2505.15917v1 (2025), preprint. arXiv.
• Gidney, C., and Ekerå, M. “How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits.” Quantum 5, 433 (2021). doi:10.22331/q-2021-04-15-433.
• Ma, X., Qi, B., Zhao, Y., and Lo, H.-K. “Practical decoy state for quantum key distribution.” Physical Review A 72, 012326 (2005). doi:10.1103/PhysRevA.72.012326.
• Nadlinger, D., et al. “Experimental quantum key distribution certified by Bell’s theorem.” Nature 607, 682–686 (2022). doi:10.1038/s41586-022-04941-5.
• National Institute of Standards and Technology. Module-Lattice-Based Key-Encapsulation Mechanism Standard. FIPS 203 (2024). Publication and updates.
• National Institute of Standards and Technology. Module-Lattice-Based Digital Signature Standard. FIPS 204 (2024). Publication and updates.
• National Institute of Standards and Technology. Stateless Hash-Based Digital Signature Standard. FIPS 205 (2024). Publication and updates.
• National Institute of Standards and Technology. Recommendations for Key-Encapsulation Mechanisms. SP 800-227 (2025). Publication.
• Pirandola, S., Laurenza, R., Ottaviani, C., and Banchi, L. “Fundamental limits of repeaterless quantum communications.” Nature Communications 8, 15043 (2017). doi:10.1038/ncomms15043.
• Tamaki, K., Curty, M., and Lucamarini, M. “Decoy-state quantum key distribution with a leaky source.” New Journal of Physics 18, 065008 (2016). doi:10.1088/1367-2630/18/6/065008.
• Yin, J., et al. “Entanglement-based secure quantum cryptography over 1,120 kilometres.” Nature 582, 501–505 (2020). doi:10.1038/s41586-020-2401-y.